Ashdfrkl

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions prior to the latest patch **Description** The RASC video decoder in libavcodec contains a flaw where the `decode dlta()` function in `libavcodec/rasc.c` performs 32-bit reads and writes at the row cursor before the `NEXT LINE` row-boundary check. Additionally, the DLTA region is validated in pixel units instead of byte units. This allows a DLTA run on a PAL8 frame to access bytes beyond the row allocation. A specially crafted media stream using the RASC FourCC can trigger a bitstream-controlled out-of-bounds heap write and an adjacent out-of-bounds read, resulting in memory corruption, denial of service, or potential arbitrary code execution. **Recommendations** Update to the latest version.

**Name of the Vulnerable Software and Affected Versions** MyBB version 1.8.40 **Description** An issue exists where users with limited Admin Control Panel (ACP) access can assign any usergroup to an account during creation or editing. This occurs because the `verify usergroup()` function in the user module datahandler unconditionally returns true for the Administrators group (gid 4). Consequently, an administrator with only delegated user-management permissions can assign the Administrators group to an account, leading to a privilege escalation to the full Administrator permission set. **Recommendations** Update MyBB to a version newer than 1.8.40. Review and restrict user permissions within the Admin Control Panel to minimize the risk of unauthorized group assignment.

**Name of the Vulnerable Software and Affected Versions** RustDesk (affected versions not specified) **Description** An issue exists where incoming control messages are gated based on per-capability flags instead of the session's authorized connection type. Because a file-transfer session fails to clear these flags, a peer with only FileTransfer authorization can perform actions outside its granted scope. This allows the peer to inject keyboard and mouse input and access the unguarded screenshot and display-capture handlers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 3.1.3 **Description** An authenticated user can execute arbitrary code in the server context by configuring a Custom MCP node. The issue occurs because environment variables are validated against a denylist using a case-sensitive comparison. On Windows systems, where environment names are case-insensitive, providing a variable like `node options` bypasses the `NODE OPTIONS` denylist entry, allowing the injection of `NODE OPTIONS --require`. **Recommendations** Update to version 3.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** Gitea act runner versions prior to 0.262.0 **Description** When using the Docker backend, the software passes the `container.options` string from a workflow to the Docker job container's HostConfig. If `privileged` is set to `false`, the system only disables the Privileged flag but merges other options such as `--pid=host`, `--cap-add`, and `--security-opt` without changes. This allows a user capable of running a workflow on a Docker-backed runner to create a job container with host namespaces and broad capabilities, enabling a container escape to the host system with root privileges. **Recommendations** Update Gitea act runner to version 0.262.0 or later.

**Name of the Vulnerable Software and Affected Versions** libssh2 versions prior to 1.11.2 **Description** An integer overflow occurs when the software reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response. This value is used in the allocation `num attrs * sizeof(libssh2 publickey attribute)` without bounds checking. On 32-bit platforms, this multiplication can overflow, resulting in an undersized buffer. A malicious SSH server can then exploit this to write past the allocation, leading to a heap buffer overflow in a connecting client. **Recommendations** Update libssh2 to a version newer than 1.11.1.

**Name of the Vulnerable Software and Affected Versions** libssh2 versions prior to 1.11.2 **Description** An issue exists in the public key parsing process where the software expands its public key list using `SSH2 REALLOC` but fails to zero-initialize new entries before they are populated. If a parse failure occurs and triggers the cleanup path, the `libssh2 publickey list free()` function may operate on an uninitialized entry. A malicious SSH server providing the public key subsystem can send a malformed response to cause the client to free an uninitialized `attrs` pointer, leading to a use-after-free condition. **Recommendations** Update libssh2 to version 1.11.2 or later.

**Name of the Vulnerable Software and Affected Versions** 7-Zip for Windows versions prior to 26.02 **Description** 7-Zip fails to preserve the Mark-of-the-Web (MotW) when extracting a specially crafted RAR5 archive. The software uses a guard to suppress archive-supplied `Zone.Identifier` streams, but it only matches the exact name `Zone.Identifier`. An attacker can use a RAR5 STM (Stream Extension) record named `:Zone.Identifier:$DATA`, which NTFS canonicalizes to the same stream, effectively overwriting the Internet-zone marker with `ZoneId=0`. Additionally, a second STM record named `::$DATA` can overwrite the extracted file's default data stream. This allows an attacker to bypass SmartScreen and MotW warnings and spoof file content. **Recommendations** Update 7-Zip for Windows to a version newer than 26.02.

**Name of the Vulnerable Software and Affected Versions** nghttp2 nghttpx versions prior to 1.69.0 **Description** The nghttpx proxy forwards HTTP/1.1 Upgrade requests that contain a `Content-Length` header and body onto reusable keep-alive backend connections. During this process, it re-adds the Upgrade and Connection headers while passing the `Content-Length` verbatim. If a backend resolves this ambiguous message in favor of an attacker, it can lead to HTTP request/response smuggling and cross-client response-queue poisoning. There have been reports of increased actor activities targeting this issue. **Recommendations** Update nghttp2 nghttpx to version 1.69.0 or later.